When Indian police investigating bomb blasts which killed 42 people traced an email claiming responsibility to a Mumbai apartment, they ordered an immediate raid.

But at the address, rather than seizing militants from the Islamist group which said it carried out the attack, they found a group of puzzled American expats.

In a cautionary tale for those still lax with their wireless internet security, police believe the email about the explosions on Saturday in the west Indian city of Ahmedabad was sent after someone hijacked the network belonging to one of the Americans, 48-year-old Kenneth Haywood.

The IP address for the email claiming responsibility for an obscure group called the Indian Mujahideen was traced by police to Haywood's laptop. They then raided the plush 15th-floor apartment.

Officers believe the email could have been sent by anyone within two floors of Haywood's flat.

"He has never been detained, but we have called on him and questioned him as part of the investigation," said Parambir Singh, a senior officer in the anti-terrorism squad.

"He has said his email ID was hacked and evidence we have gathered shows that his network was used to forward the mail."

The Hindustan Times newspaper quoted Haywood, a business consultant, as saying the technician who set up the web connection had insisted he not change his default password.

He told the paper he had already complained about excessively high browsing bills: "I found that my net usage had suddenly increased and I started getting inflated bills."

Singh said Haywood and the other occupants of the flat — variously reported as being another man or his family — were still being questioned.

"We are not saying that they are suspects, but at the same time we cannot, at the moment, give them a clean chit," he said.

The hunt for those behind the blasts is now centred on Mumbai. Police believe the plot was hatched in the suburb of Navi Mumbai, from where four cars used in the attack were stolen.

The death toll from the 22 separate bombs was initially put at 45, but later reduced to 42 after it emerged some fatalities had been reported twice amid the confusion. More than 180 people were injured.